Skip to content

Customizing the NaaS Onboarding Workflow

The out-of-the-box Namespace as a Service workflow will generate a Namespace and RoleBindings, along with the groups needed to manage access. This is rarely enough to satisfy multitenancy requirements. You'll generally want to create at least a ResourceQuota, maybe NetworkPolicys, etc. There are several customization points where you can add your own tasks.

Workflow Hooks

You can run multiple custom workflows at different points through the Namepsace creation process. A custom workflow is where you can create custom objects in your cluster, your new Namespace, or a remote system like a GitHub or Gitlab repository. All custom workflows should be associated with a non existent Organization and not be "listed". For instance, the below workflow creates a ResourceQuota after the Namespace is created:

kind: Workflow
  name: create-resource-quota
  namespace: openunison
  description: creates a ResourceQuota object
  inList: false
  label: Creates a ResourceQuota
  orgId: internal-does-not-exist
  tasks: |-
      - taskType: customTask
        className: com.tremolosecurity.provisioning.tasks.CreateK8sObject
            targetName: $cluster$
            template: |-
                kind: ResourceQuota
                apiVersion: v1
                  name: resource-quota
                  namespace: $nameSpace$
                        cpu: "5"
                        memory: 10Gi
                        pods: 10
            srcType: yaml
            writeToRequest: "$useGit$"
            requestAttribute: git-secret-cluster-k8s-$nameSpace$
            path: /yaml/ns/$nameSpace$/resourcequotas/

There are some variables available to your workflow:

Request Attribute Name
$nameSpace$ The Namespace to be created
$cluster$ The target cluster where to create the tenant

Once you've deployed your Workflow, set its name to the correct setting (see below) in your values.yaml and redeploy the tremolo/orchestra-k8s-cluster-management chart. See the Kubernetes Workflow Tasks for how to interact with your clusters from an OpenUnison Workflow.

Pre-Run Workflow

This hook is where you can run any processes you want to start before the workflow begins building out the tenant. This is before groups are created. This might be a good time to create a git repository as an example.

Helm Value: openunison.naas.workflows.new_namespace.pre_run_workflow

Pre-Provision Workflow

You can define a workflow that will run after the groups are all created, but before the Namespace is created. This may be a good time to create cluster level objects. Once your workflow is created.

Helm Value: openunison.naas.workflows.new_namespace.pre_provision_workflow

Post Namespace Create Workflow

Once the namespace is created, you can run a workflow to create additional objects in the Namespace.

Helm Value: openunison.naas.workflows.new_namespace.post_namespace_create_workflow

Custom Attributes

The form for onboarding a new namespace can have custom attributes added. These attributes can be as simple as a text box, or as complex as a drop down with values loaded from an external API. Adding an attribute requires an update to the openunison.naas.forms.new_namespace.additional_attributes section. For instance, if you wanted to as users if they want to enable istio side car injection in your namespace, you could add:

        - name: istio_enabled
          # what will be displayed on the form
          displayName: Enable Istio Sidecars
          # validating regular expression
          regEx: ".*"
          # An error to provide the user if the regex fails
          regExFailedMsg: "Invalid istio configuration"
          # minimum number of characters
          minChars: 0
          # maximum number of characters
          maxChars: 0
          # should the value of this attribute be unique in OpenUnison
          unique: false
          # can by one of list, text, dynamicList
          type: list
          # if list, the values and labels in the form of DisplayLabel=value
          - Enabled=enabled
          - Disabled=disabled

Once the attribute is added to a form, it's available to workflows as both a request object with the name of the attribute or a user attribute. Attribute values are also available to approvers to provide additional context.

Namespace Labels and Annotations

When the namespace is provisioned, it can have custom labels and annotations. These annotations and labels can be generated from custom attributes, or created in a (workflow hook)[#workflow_hooks]. The value for an annotation or label must be preset in the request object. You add custom labels through name/value pairs in openunison.naas.workflows.new_namespace.namespace_request_labels and annotations through openunison.naas.workflows.new_namespace.namespace_request_annotations. For instance, to add the istio-injection label to a new namespace, you would add:

            istio-injection: istio_enabled